Communication method and apparatus, and computer-readable storage medium

Abstract

Provided in the embodiments of the present disclosure are a communication method and apparatus, and a computer-readable storage medium. The method comprises: receiving an authentication indication of a second node, wherein the authentication indication is used for instructing a first node to perform network authentication; sending a first authentication request to the second node, wherein the first authentication request is used for requesting that identity legitimacy of the first node is verified; receiving a second authentication request of the second node, wherein the second authentication request is used for requesting that identity legitimacy of the second node is verified; and after verification for the second authentication request is successful, communicating with the second node. The present disclosure can be used in a wireless communication process.

Description

Communication method, device, and computer-readable storage medium

[0001] This disclosure claims priority to Chinese patent application No. 202310894349.3, filed on July 19, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present disclosure relates to the field of communication technologies, and in particular to a communication method, device, and computer-readable storage medium. Background Art

[0003] In communications technology, authentication is required before a terminal can access a network. Currently, authentication is performed by encrypting transmitted information using a shared key between the terminal and the network. Both communicating parties then verify the encrypted information using the shared key.

[0004] Summary of the Invention

[0005] In one aspect, a communication method is provided, applied to a first node. The communication method includes:

[0006] receiving an authentication instruction from the second node; the authentication instruction is used to instruct the first node to perform network authentication;

[0007] Sending a first authentication request to the second node; the first authentication request is used to request verification of the legitimacy of the identity of the first node;

[0008] receiving a second authentication request from the second node; the second authentication request is used to request verification of the legitimacy of the identity of the second node;

[0009] After the second authentication request is verified, communicate with the second node.

[0010] On the other hand, a communication method is provided, which is applied to a second node. The communication method includes:

[0011] Sending an authentication instruction; the authentication instruction is used to instruct the first node to perform network authentication;

[0012] Receiving a first authentication request from a first node; the first authentication request is used to request verification of the legitimacy of the identity of the first node;

[0013] After the first authentication request is verified, a second authentication request is sent to the first node; the second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0014] In another aspect, a communication device is provided, which includes a receiving module, a sending module, and a communication module.

[0015] The receiving module is used to receive an authentication instruction from the second node; the authentication instruction is used to instruct the first node to perform network authentication;

[0016] The sending module is used to send a first authentication request to the second node; the first authentication request is used to request verification of the legitimacy of the identity of the first node;

[0017] The receiving module is further configured to receive a second authentication request from the second node; the second authentication request is used to request verification of the legitimacy of the identity of the second node;

[0018] The communication module is used to communicate with the second node after the second authentication request is verified.

[0019] In another aspect, a communication device is provided, which includes a sending module and a receiving module.

[0020] The sending module is used to send an authentication instruction; the authentication instruction is used to instruct the first node to perform network authentication;

[0021] The receiving module is used to receive a first authentication request from a first node; the first authentication request is used to request verification of the legitimacy of the identity of the first node;

[0022] The sending module is used to send a second authentication request to the first node after the first authentication request is verified; the second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0023] In another aspect, a communication system is provided, comprising: a first node and a second node.

[0024] The second node sends an authentication indication, which is used to instruct the first node to perform network authentication; the first node sends a first authentication request to the second node; the first authentication request is used to request verification of the legitimacy of the identity of the first node; after the first authentication request is verified, the second node sends a second authentication request to the first node; the second authentication request is used to request verification of the legitimacy of the identity of the second node; after the second authentication request is verified, the first node communicates with the second node.

[0025] In yet another aspect, a communication device is provided, comprising: a memory and a processor; the memory and the processor are coupled; the memory is configured to store a computer program; and the processor implements the communication method described in any one of the above aspects or embodiments when executing the computer program.

[0026] On the other hand, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the communication method according to any one of the above aspects or embodiments is implemented.

[0027] On the other hand, a computer program product is provided, which includes computer program instructions, and when the computer program instructions are executed by a processor, the communication method according to any one of the above aspects or embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the present disclosure, the following briefly introduces the drawings required for use in some embodiments of the present disclosure. Obviously, the drawings described below are only drawings of some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0029] FIG1 is a schematic structural diagram of a communication system according to some embodiments.

[0030] FIG2 is a flow chart of a communication method according to some embodiments.

[0031] FIG3 is a flow chart of another communication method according to some embodiments.

[0032] FIG4 is a flowchart of yet another communication method according to some embodiments.

[0033] FIG5 is an interactive diagram of a communication method according to some embodiments.

[0034] FIG6 is an interaction diagram of another communication method according to some embodiments.

[0035] FIG7 is an interaction diagram of yet another communication method according to some embodiments.

[0036] FIG8 is a schematic diagram illustrating the structure of a communication device according to some embodiments.

[0037] FIG9 is a schematic diagram illustrating the structure of another communication device according to some embodiments.

[0038] FIG10 is a schematic diagram illustrating the structure of yet another communication device according to some embodiments. DETAILED DESCRIPTION

[0039] The following will clearly and completely describe the technical solutions of this disclosure in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this disclosure, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of this disclosure without making any creative efforts shall fall within the scope of protection of this disclosure.

[0040] It should be noted that in this disclosure, words such as "exemplarily" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this disclosure as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplarily" or "for example" is intended to present the relevant concepts in a concrete manner.

[0041] In the following, the terms "first," "second," etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the quantity of the technical features indicated. Therefore, a feature specified as "first," "second," etc. may explicitly or implicitly include one or more of the features.

[0042] In the description of this disclosure, unless otherwise specified, " / " means "or." For example, A / B can mean A or B. "And / or" herein is simply a way to describe an association relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: only A, only B, and both A and B. Furthermore, "at least one" means one or more, and "a plurality" means two or more.

[0043] When a user-side terminal initially accesses the network, it needs to be authenticated to obtain access rights. The existing fifth-generation mobile communication technology authentication and agreement (5G AKA) authentication system includes traditional peer-to-peer key verification, that is, the user-side terminal and the network side jointly hold a peer key to encrypt some certain and random information. The user-side terminal and the network side then verify whether the encrypted content of the other party is encrypted with the peer key, thereby proving the identities of both parties. For the network side, it is necessary to centrally store the peer keys of all user terminals to perform authentication when the terminal accesses.

[0044] The following is a brief description of the 5G AKA authentication process. When the terminal initiates registration with the network to start the authentication process, the UDM network element generates a 5G home environment authentication vector (5G HE AV) and provides it to the authentication server function (AUSF) network element. The 5G HE AV contains XRES* (expected authentication response*), AUTN (authentication token), RAND (challenge random number), and Kausf. Kausf is derived from two keys (CK (Cipher Key) and IK (Integrity Key), derived from the root key) and SQN (Sequence Number). The AUSF network element derives XRES* and Kausf into HXRES* and Kseaf, the latter of which will be used as the key for the next step. The AUSF network element combines AUTN, RAND, and HXRES* to form a 5G SE AV and passes it to the security anchor function (SEAF) network element. The SEAF network element sends AUTN and RAND to the terminal. The terminal uses the common keys CK and IK, as well as the SQN, to calculate a MAC and compare it with the MAC* contained in the AUTH packet to authenticate the network. If a RES* corresponding to XRES* is calculated in the same manner, the RES* is sent to the SEAF network element. The SEAF network element processes the RES* to obtain an HRES* and compares it with the HXRES* to authenticate the terminal. If the RES* is sent to the AUSF network element, it is compared with the XRES* for secondary authentication. If the result is successful, the authentication process ends.

[0045] As can be seen from the above description of the 5G AKA authentication process, all terminal authentication requires the use of a root key stored in the UDM network element. Due to its importance to network security, the root key must be stored only in the UDM network element. Since UDM network elements often need to serve millions of users, the high frequency of user access places a heavy load on the UDM network element, which can easily cause communication channel congestion and increased latency. According to the existing 5G AKA process, if the authentication process delays too long, the entire process must be restarted, further increasing the congestion of the UDM network element. This centralized authentication method carries the risk of UDM network element failure, potentially paralyzing the entire network.

[0046] In summary, there is an urgent need for a decentralized authentication method.

[0047] Based on this, an embodiment of the present disclosure provides a communication method, in which the first node can send an authentication request after receiving the authentication instruction of the second node so that the second node can verify the legitimacy of the first node, and obtain the authentication request sent by the second node to verify the legitimacy of the second node. Communicate with the second node after the verification is passed. The communication method provided by the present disclosure adopts a two-way authentication method, so that the authentication does not rely on the UDM network element, so that any node in the network can realize the authentication of the terminal, avoiding the risk of a single point failure causing the entire network to be paralyzed, and effectively improving the stability of the communication system.

[0048] The network architecture of the mobile communication system (including but not limited to 5G and future 6G mobile communication systems) in the embodiments of the present disclosure may include a first node and a second node. In some examples, the first node may be a terminal / user equipment (UE), and the second node may be a network-side device (e.g., a core network element, a base station, etc.). In other examples, the first node may be a network-side device, and the second node may be a terminal. In yet other examples, in a user-to-user communication scenario, the first node and the second node may both be terminals. The embodiments of the present disclosure are not limited thereto.

[0049] The following description is made by taking the first node as a terminal and the second node as a network-side device / terminal as an example.

[0050] Figure 1 is a schematic diagram of the structure of a communication system provided by an embodiment of the present disclosure. As shown in Figure 1, the communication system includes network-side devices and terminals. The network-side devices and terminals can be connected via a wireless network. The wireless network can be supported by routers, switches, or other devices that facilitate communication between the network-side devices and terminals, and this embodiment of the present disclosure does not limit this.

[0051] In some embodiments, the network-side device may be a base station or a core network element, such as an authentication server function (AUSF) element. When the network-side device is a core network element, the communication system further includes a base station for relaying signals between the terminal and the core network element.

[0052] In some embodiments, a base station is used to provide wireless access services to terminals. For example, a base station provides a service coverage area (also known as a cell). Terminals within this area can communicate with the base station via wireless signals to receive the wireless access services provided by the base station. Furthermore, the base station's service coverage area can be divided into near-field and far-field areas. Terminals may be within the near-field or far-field area.

[0053] In some embodiments, a base station can be a millimeter wave base station, an evolution nodeB (eNB), a next-generation nodeB (gNB), a transmission receive point (TRP), a transmission point (TP), or some other access node. Based on the size of the service coverage area provided, a base station can be further classified as a macro base station for providing macro cells, a micro base station for providing pico cells, and a femto base station for providing femto cells. As wireless communication technology continues to evolve, future base stations may also adopt other names.

[0054] In some embodiments, the terminal may be a device with wireless transceiver capabilities, such as a mobile phone, a tablet computer, a wearable device, an in-vehicle device, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiments of the present disclosure do not limit the specific type of the terminal.

[0055] It should be understood that FIG1 is an exemplary structural diagram, and the number of devices included in the communication system shown in FIG1 is not limited, for example, the number of network devices is not limited, and the number of terminals is not limited. Furthermore, in addition to the devices shown in FIG1 , the communication system shown in FIG1 may also include other devices, which is not limited.

[0056] Figure 2 is a flow chart of a communication method provided by an embodiment of the present disclosure. Exemplarily, the communication method provided by the present disclosure can be applied to the communication system shown in Figure 1, for example, can be applied to the first node, that is, the terminal in Figure 1.

[0057] As shown in FIG2 , the communication method provided by the present disclosure may include the following steps:

[0058] S201: A first node receives an authentication instruction from a second node.

[0059] The authentication instruction is used to instruct the first node to perform network authentication.

[0060] S202: The first node sends a first authentication request to the second node.

[0061] The first authentication request is used to request verification of the legitimacy of the identity of the first node.

[0062] Regarding S201 and S202 above, when network access is required, the second node may broadcast an authentication instruction to instruct the terminal to perform network authentication. After receiving the authentication instruction, the first node may first send a first authentication request to the second node to request the second node to verify the legitimacy of its identity.

[0063] In some embodiments, the authentication instruction includes first user authentication information (UE-certification), which is used to verify the legitimacy of the identity of the first node. The first authentication request includes: the digital identity of the first node, second user authentication information, and first network authentication information, where the second user authentication information (UE-certification-encrypted) is the encrypted first user authentication information; the first network authentication information is used to verify the legitimacy of the second node.

[0064] It is understood that the digital identity is a digital code issued by a legitimate certification authority and serves as proof of identity for a device on the network. This digital identity can be a digital certificate or a decentralized digital identity (DID). In the case of a digital certificate, the digital identity transmission method transmits the entire digital certificate. In the case of a DID, the digital identity transmission method may only transmit the minimum information that can identify the user, such as the user number.

[0065] In some embodiments, the digital identity may be transmitted in an encrypted manner to prevent the user from being tracked. The disclosed embodiments do not specifically limit the encryption method. As an example, the digital identity may be encrypted by encrypting the subscription permanent identifier (SUPI) into a subscription concealed identifier (SUCI).

[0066] In some embodiments, the first user authentication information may be carried in system information block (SIB) signaling, for example, in SIB1.

[0067] In some embodiments, the second user authentication information is the first user authentication information encrypted by the private key (K-privte-ue) of the digital identity of the first node.

[0068] In some embodiments, the first user verification information and the first network verification information may be a string of numbers or a character string, etc. In addition, the verification information may change over time to prevent the verification information from being intercepted and obtained by other illegal users and then used in the authentication process.

[0069] S203: The first node receives a second authentication request from the second node.

[0070] The second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0071] In some embodiments, the first authentication request includes first network certification information (network-certification), which is used to verify the legitimacy of the second node. The second authentication request includes: the digital identity of the second node and second network certification information, where the second network certification information (network-certification-encrypted) is the encrypted first network certification information.

[0072] In some embodiments, the second network authentication information is the first network authentication information encrypted by a private key (K-privte-network) of the digital identity of the second node.

[0073] S204: After the second authentication request is verified, the first node communicates with the second node.

[0074] With respect to S203 and S204 above, after sending the first authentication request to the second node, the first node may receive a second authentication request from the second node and verify the legitimacy of the second node's identity based on the second authentication request. After the second authentication request is verified, a communication connection is established between the first node and the second node.

[0075] In some embodiments, before S204, a verification process for the second authentication request is further performed. The verification process may include the following steps:

[0076] Step a: The first node obtains the public key of the first granting authority to which the second node's digital identity belongs. Step b: The first node uses the public key of the first granting authority to decrypt the second node's digital identity, obtaining the public key of the second node's digital identity (K-publick-network). Step c: The first node uses the public key of the second node's digital identity to decrypt the second network verification information, obtaining the third network verification information (network-certification*). Step d: If the third network verification information is consistent with the first network verification information, the second authentication request is determined to have been verified successfully.

[0077] In some embodiments, the public key of the first authority may be stored in a storage space of the first node.

[0078] It can be understood that the above verification method can not only verify whether the digital identity is legal (using the public key of the first granting agency to decrypt the digital identity, and successfully obtaining the public key of the digital identity can be considered legal), but also verify whether the digital identity belongs to the second node (by comparing the first network verification information with the decrypted second network verification information), thereby improving the accuracy of verification.

[0079] In some embodiments, the second node may include the encrypted symmetric key (communication parameter) in the second authentication request to inform the first node of the symmetric key to be used for subsequent communication. Therefore, as shown in FIG3 , the above S204 may also be implemented as S2041-S2042 below.

[0080] S2041. The first node uses the private key of the digital identity of the first node to decrypt the communication parameters to obtain a symmetric key.

[0081] S2042: The first node communicates with the second node using a symmetric key.

[0082] It should be understood that using symmetric keys for encryption and decryption can effectively improve data encryption and decryption efficiency and shorten data processing time. Therefore, after the authentication request is verified, using symmetric keys for communication can effectively improve communication efficiency. In addition, using the public key corresponding to the terminal's digital identity for encryption ensures that only the private key corresponding to the terminal's digital identity can decrypt, thus ensuring the transmission security of the symmetric key.

[0083] In some embodiments, when a base station malfunctions temporarily due to certain special circumstances, the terminal (first node) is unable to access the network for communication via the base station. The communication method provided in the embodiments of the present disclosure can also support inter-terminal communication. That is, when both the first node and the second node are terminals, before S201 above, the first node further performs S200 below.

[0084] S200: The first node broadcasts a communication requirement.

[0085] The communication demand is used to request communication with the second node.

[0086] Regarding the above S200, if the first node has a communication demand, it can broadcast the communication demand to other terminals around it. If a terminal (i.e., the second node) responds to the communication demand, the first node executes the above S201-S204 processes to establish a communication connection with the second node.

[0087] Figure 4 is a flow chart of a communication method provided by an embodiment of the present disclosure. Exemplarily, the communication method provided by the present disclosure can be applied to the communication system shown in Figure 1, for example, can be applied to the second node, and can be applied to the network side device in Figure 1.

[0088] As shown in FIG4 , the communication method provided by the present disclosure may include the following steps:

[0089] S401: The second node sends an authentication instruction.

[0090] The authentication instruction is used to instruct the first node to perform network authentication.

[0091] S402: The second node receives a first authentication request from the first node.

[0092] The first authentication request is used to request verification of the legitimacy of the identity of the first node.

[0093] S403: After the first authentication request is verified, the second node sends a second authentication request to the first node.

[0094] The second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0095] Regarding S401-S403 above, when network access is required, the second node can broadcast an authentication instruction to instruct terminals within its signal coverage to perform network authentication. The second node can then receive a first authentication request from the first node and verify the legitimacy of the first node's identity. After the first authentication request is verified, the second node determines that the first node is legitimate and sends a second authentication request to the first node, requesting the first node to verify its own identity, thus achieving two-way authentication.

[0096] In some embodiments, the communication method provided by the embodiments of the present disclosure further includes the following verification steps: Step a: Obtain the public key of the second granting authority to which the digital identity of the first node belongs. Step b: Decrypt the digital identity of the first node using the public key of the second granting authority to obtain the public key (K-publick-ue) of the digital identity of the first node. Step c: Decrypt the second user verification information using the public key of the digital identity of the first node to obtain third user verification information. Step d: If the third user verification information is consistent with the first user verification information, determine that the first authentication request has been verified.

[0097] It should be understood that the second granting institution and the first granting institution may be the same institution or different institutions.

[0098] In some embodiments, when the second node is a network-side device (e.g., a base station, an AUSF network element), the public key of the second granting agency can be uploaded to the blockchain for storage, and the second node can obtain the public key of the second granting agency by accessing the blockchain. Alternatively, the public key of the second granting agency can be stored in a preset storage space (e.g., a base station, an edge node, a UDM network element, an AUSF network element, etc. of the network), and the second node can obtain the public key of the second granting agency from the preset storage space. When the second node is a terminal, the public key of the second granting agency can be stored in the terminal in advance and directly obtained and used when needed.

[0099] When the second node is a base station, the digital identity of the second node should be stored in a dedicated authentication unit that is physically isolated from other units, similar to a SIM card. The encryption of the first network authentication information should also be performed in this dedicated authentication unit. The digital identity of the second node can be the digital identity of the network or the digital identity of the base station itself.

[0100] In some embodiments, the second node can inform the first node of the symmetric key used for communication, so that the first node can subsequently communicate with the second node using the symmetric key, thereby improving communication efficiency. Therefore, the second authentication request also includes communication parameters, which are the symmetric key encrypted with the public key of the first node's digital identity.

[0101] As mentioned above, when a base station fails to operate, the communication method provided by the embodiment of the present disclosure can also realize communication between terminals. That is, when the first node and the second node are both terminals, before S401, the second node further performs the following S400.

[0102] S400: In response to a communication request from a first node, the second node sends an authentication instruction to the first node.

[0103] As previously described, in S200, the first node broadcasts a communication request to its surroundings. If a second node receives the communication request and also has a communication need, the second node may approve the communication request. In other words, in response to the first node's communication request, the second node sends an authentication instruction to the first node. The second node then continues to execute steps S401-S403 above.

[0104] According to the communication method provided by the embodiment of the present disclosure, in this method, after receiving the authentication instruction of the second node, the first node can send an authentication request to enable the second node to verify the legitimacy of the first node, and obtain the authentication request sent by the second node to verify the legitimacy of the second node. Communicate with the second node after the verification is passed. The communication method provided by the present disclosure adopts a two-way authentication method, so that the authentication can be independent of the UDM network element, so that any node in the network can realize the authentication of the terminal, avoiding the risk of a single point failure causing the entire network to be paralyzed, and effectively improving the stability of the communication system.

[0105] Furthermore, using digital identities for authentication not only verifies the legitimacy of the digital identity but also confirms that the device sending the authentication request matches the digital identity, further ensuring communication security. Furthermore, after successful authentication, communication using symmetric keys improves the efficiency of the communication system and complies with existing communication standards.

[0106] Figure 5 is an interactive schematic diagram of a communication method provided by an embodiment of the present disclosure. Taking the network side device as an AUSF network element as an example, as shown in Figure 5, the communication system also includes a base station and an AMF network element. First, the base station broadcasts the indication information. After receiving the indication information, the terminal generates a user authentication request (the above-mentioned first authentication request) and sends it to the AMF network element through the base station. Then the AMF network element adds the network name to the user authentication request and forwards the user authentication request to the AUSF network element. The AUSF network element verifies the user authentication request. After the verification is passed, it generates a symmetric key based on the network name carried in the user authentication request and encrypts the symmetric key to generate a network authentication request carrying the encrypted symmetric key (the above-mentioned second authentication request). The AUSF network element then sends the network authentication request to the terminal through the AMF network element and the base station in sequence. After the terminal verifies that the network authentication request is passed, it decrypts to obtain the symmetric key and uses the symmetric key for communication.

[0107] Figure 6 is an interactive diagram of a communication method provided by an embodiment of the present disclosure. Taking the network-side device as a base station as an example, as shown in Figure 6, first, the base station broadcasts instruction information. After receiving the instruction information, the terminal generates a user authentication request (the above-mentioned first authentication request) and sends it to the base station. The base station then verifies the user authentication request and, if it passes, generates a network authentication request (the above-mentioned second authentication request) carrying an encrypted symmetric key and sends it to the terminal. The terminal verifies and decrypts the symmetric key to obtain the symmetric key and uses the symmetric key to communicate with the base station.

[0108] Figure 7 is an interactive schematic diagram of a communication method provided by an embodiment of the present disclosure. Taking the network-side device as a terminal as an example, as shown in Figure 7, the communication system includes terminal a and terminal b. First, terminal a broadcasts the communication demand. If terminal b agrees to the communication demand, it sends an indication message to terminal a. After receiving the indication message, terminal a generates a user authentication request (the above-mentioned first authentication request) and sends it to terminal b. Terminal b then verifies the user authentication request, and after passing it, generates a network authentication request (the above-mentioned second authentication request) carrying an encrypted symmetric key and sends it to terminal a. Terminal a verifies and decrypts the symmetric key to obtain the symmetric key, and uses the symmetric key to communicate with terminal b.

[0109] It is understandable that, in order to implement the above functions, the communication device (which may be the first node or the second node) includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in conjunction with the algorithm steps of each example described in the embodiments of the present disclosure, the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present disclosure.

[0110] The embodiments of the present disclosure can divide the functional modules of the communication device according to the above-mentioned method embodiments. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one functional module. The above-mentioned integrated modules can be implemented in the form of hardware or software. It should be noted that the division of modules in the embodiments of the present disclosure is schematic and is only a logical functional division. In actual implementation, there may be other division methods. The following is an example of dividing each functional module corresponding to each function.

[0111] FIG8 is a schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure, which can execute the communication method provided by the above method embodiment. As shown in FIG8 , the communication device includes: a receiving module 801 , a sending module 802 and a communication module 803 .

[0112] The receiving module 801 is used to receive an authentication instruction from the second node; the authentication instruction is used to instruct the first node to perform network authentication.

[0113] The sending module 802 is used to send a first authentication request to the second node; the first authentication request is used to request verification of the legitimacy of the identity of the first node.

[0114] The receiving module 801 is further configured to receive a second authentication request from the second node; the second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0115] The communication module 803 is used to communicate with the second node after the second authentication request is verified.

[0116] In some embodiments, the authentication indication includes first user verification information, which is used to verify the legitimacy of the identity of the first node; the first authentication request includes: the digital identity of the first node, second user verification information and first network verification information; the second user verification information is the encrypted first user verification information; the first network verification information is used to verify the legitimacy of the second node.

[0117] In some embodiments, the second user authentication information is the first user authentication information encrypted with the private key of the digital identity of the first node.

[0118] In some embodiments, the first authentication request includes first network verification information, which is used to verify the legitimacy of the second node; the second authentication request includes: the digital identity of the second node and the second network verification information; the second network verification information is the encrypted first network verification information.

[0119] In some embodiments, the second network verification information is the first network verification information encrypted with the private key of the digital identity of the second node.

[0120] In some embodiments, the above device further includes: an acquisition module 804 and a processing module 805 .

[0121] The acquisition module 804 is configured to acquire the public key of the first granting institution to which the digital identity of the second node belongs.

[0122] The processing module 805 is configured to decrypt the digital identity of the second node using the public key of the first granting authority to obtain the public key of the digital identity of the second node; decrypt the second network verification information using the public key of the digital identity of the second node to obtain third network verification information; and determine that the second authentication request has been verified successfully if the third network verification information is consistent with the first network verification information.

[0123] In some embodiments, the second authentication request further includes: communication parameters; the communication module 803 can be used to use the private key of the digital identity of the first node to decrypt the communication parameters to obtain a symmetric key; and use the symmetric key to communicate with the second node.

[0124] In some embodiments, when both the first node and the second node are terminals, the sending module 802 is further configured to broadcast a communication demand; the communication demand is used to request communication with the second node.

[0125] FIG9 is a schematic diagram of the structure of another communication device provided by an embodiment of the present disclosure, which can execute the communication method provided by the above method embodiment. As shown in FIG9 , the communication device includes: a sending module 901 and a receiving module 902.

[0126] The sending module 901 is used to send an authentication instruction; the authentication instruction is used to instruct the first node to perform network authentication.

[0127] The receiving module 902 is used to receive a first authentication request from a first node; the first authentication request is used to request verification of the legitimacy of the identity of the first node.

[0128] The sending module 901 is further configured to send a second authentication request to the first node after the first authentication request is verified. The second authentication request is configured to request verification of the legitimacy of the identity of the second node.

[0129] In some embodiments, the authentication indication includes first user verification information, which is used to verify the legitimacy of the identity of the first node; the first authentication request includes: the digital identity of the first node, second user verification information and first network verification information; the second user verification information is the encrypted first user verification information; the first network verification information is used to verify the legitimacy of the second node.

[0130] In some embodiments, the second user authentication information is the first user authentication information encrypted with the private key of the digital identity of the first node.

[0131] In some embodiments, the first authentication request includes first network verification information, which is used to verify the legitimacy of the second node; the second authentication request includes: the digital identity of the second node and the second network verification information; the second network verification information is the encrypted first network verification information.

[0132] In some embodiments, the second network verification information is the first network verification information encrypted with the private key of the digital identity of the second node.

[0133] In some embodiments, the above apparatus further includes an acquisition module 903 and a processing module 904 .

[0134] The acquisition module 903 is used to acquire the public key of the second granting institution to which the digital identity of the first node belongs.

[0135] The processing module 904 is used to use the public key of the second granting agency to decrypt the digital identity of the first node to obtain the public key of the digital identity of the first node; use the public key of the digital identity of the first node to decrypt the second user verification information to obtain the third user verification information; when the third user verification information is consistent with the first user verification information, it is determined that the first authentication request verification is successful.

[0136] In some embodiments, the second authentication request further includes a communication parameter; the communication parameter is a symmetric key encrypted with the public key of the digital identity of the first node.

[0137] In some embodiments, when both the first node and the second node are terminals, the sending module 901 may be configured to send an authentication indication to the first node in response to a communication request from the first node.

[0138] An embodiment of the present disclosure provides a communication system, which includes a first node and a second node. The first node is used to execute the methods described in S201-S204 above, and the second node is used to execute the methods described in S401-S403 above.

[0139] In the case of implementing the functions of the above-mentioned integrated modules in hardware, the embodiments of the present disclosure provide another possible structure of the electronic device or communication device involved in the above-mentioned embodiments. As shown in Figure 10, the communication device 100 includes: a processor 1002 and a bus 1004. In some embodiments, the electronic device or communication device may also include a memory 1001; in some embodiments, the electronic device or communication device may also include a communication interface 1003.

[0140] Processor 1002 may be a logic block, module, or circuit that implements or executes the various examples described in conjunction with the embodiments of this disclosure. Processor 1002 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array, or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. Processor 1002 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, or a combination of a DSP and a microprocessor.

[0141] The communication interface 1003 is used to connect to other devices via a communication network, such as Ethernet, wireless access network, or wireless local area network (WLAN).

[0142] The memory 1001 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.

[0143] As a possible implementation, the memory 1001 can exist independently of the processor 1002. The memory 1001 can be connected to the processor 1002 via a bus 1004 to store instructions or program codes. When the processor 1002 calls and executes the instructions or program codes stored in the memory 1001, the communication method provided in the embodiment of the present disclosure can be implemented.

[0144] In another possible implementation, the memory 1001 may also be integrated with the processor 1002 .

[0145] Bus 1004 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 1004 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, FIG10 shows only one thick line, but this does not mean that there is only one bus or only one type of bus.

[0146] In some embodiments, executable instructions are stored in the memory 1001. When the processor 1002 executes the executable instructions, the electronic device or communication device executes the communication method described in any of the above embodiments.

[0147] Some embodiments of the present disclosure provide a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium), which stores computer program instructions. When the computer program instructions are executed on a computer, the computer executes the communication method described in any of the above embodiments.

[0148] Exemplarily, the above-mentioned computer-readable storage media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks, or magnetic tapes, etc.), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., erasable programmable read-only memories (EPROMs), cards, sticks, or key drives, etc.). The various computer-readable storage media described in the present disclosure may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and / or carrying instructions and / or data.

[0149] An embodiment of the present disclosure provides a computer program product comprising instructions. When the computer program product is run on a computer, the computer is enabled to execute the communication method described in any one of the above embodiments.

[0150] The above is only a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any changes or replacements within the technical scope disclosed in the present disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. A communication method, applied to a first node, the method comprising: receiving an authentication indication from a second node; The authentication instruction is used to instruct the first node to perform network authentication; Sending a first authentication request to the second node; The first authentication request is used to request verification of the legitimacy of the identity of the first node; receiving a second authentication request from the second node; The second authentication request is used to request verification of the legitimacy of the identity of the second node; After the second authentication request is verified, communicate with the second node.

2. The method according to claim 1, wherein: The authentication instruction includes first user verification information, where the first user verification information is used to verify the legitimacy of the identity of the first node; The first authentication request includes: the digital identity of the first node, second user verification information and first network verification information; the second user verification information is the encrypted first user verification information; the first network verification information is used to verify the legitimacy of the second node.

3. The method according to claim 2, wherein: The second user authentication information is the first user authentication information encrypted by the private key of the digital identity of the first node.

4. The method according to claim 1, wherein: The first authentication request includes first network verification information, where the first network verification information is used to verify the legitimacy of the second node; The second authentication request includes: the digital identity of the second node and second network verification information; The second network authentication information is the encrypted first network authentication information.

5. The method according to claim 4, wherein: The second network authentication information is the first network authentication information encrypted by the private key of the digital identity of the second node.

6. The method according to claim 5, further comprising: Obtaining a public key of a first granting institution to which the digital identity of the second node belongs; Decrypting the digital identity of the second node using the public key of the first granting institution to obtain the public key of the digital identity of the second node; decrypting the second network verification information using the public key of the digital identity of the second node to obtain third network verification information; When the third network verification information is consistent with the first network verification information, it is determined that the second authentication request is verified successfully.

7. The method according to any one of claims 1 to 6, wherein: The second authentication request further includes: communication parameters; The communicating with the second node comprises: Decrypting the communication parameters using the private key of the digital identity of the first node to obtain a symmetric key; The symmetric key is used to communicate with the second node.

8. The method according to claim 1, wherein: In the case where both the first node and the second node are terminals, the method further includes: Broadcasting communication requirements; the communication requirements are used to request communication with the second node.

9. A communication method, applied to a second node, the method comprising: Send authentication instructions; The authentication instruction is used to instruct the first node to perform network authentication; receiving a first authentication request from the first node; The first authentication request is used to request verification of the legitimacy of the identity of the first node; After the first authentication request is verified, sending a second authentication request to the first node; The second authentication request is used to request verification of the legitimacy of the identity of the second node.

10. The method according to claim 9, wherein: The authentication instruction includes first user verification information, where the first user verification information is used to verify the legitimacy of the identity of the first node; The first authentication request includes: the digital identity of the first node, second user verification information and first network verification information; the second user verification information is the encrypted first user verification information; the first network verification information is used to verify the legitimacy of the second node.

11. The method according to claim 10, wherein: The second user authentication information is the first user authentication information encrypted by the private key of the digital identity of the first node.

12. The method according to claim 9, wherein: The first authentication request includes first network verification information, and the first network verification information is used to verify the legitimacy of the second node; the second authentication request includes: the digital identity of the second node and second network verification information; the second network verification information is the encrypted first network verification information.

13. The method according to claim 12, wherein: The second network authentication information is the first network authentication information encrypted by the private key of the digital identity of the second node.

14. The method according to claim 11, wherein: The method further comprises: Obtaining a public key of a second granting institution to which the digital identity of the first node belongs; Decrypting the digital identity of the first node using the public key of the second granting institution to obtain the public key of the digital identity of the first node; Decrypting the second user verification information using the public key of the digital identity of the first node to obtain third user verification information; When the third user verification information is consistent with the first user verification information, it is determined that the first authentication request is verified successfully.

15. The method according to any one of claims 9 to 14, wherein: The second authentication request also includes a communication parameter; the communication parameter is a symmetric key encrypted by the public key of the digital identity of the first node.

16. The method according to claim 9, wherein: In a case where both the first node and the second node are terminals, the sending an authentication indication includes: In response to the communication request of the first node, the authentication indication is sent to the first node.

17. A communication device, comprising: a processor and a memory for storing instructions executable by the processor; The processor is configured to execute the instruction so that the communication device performs the communication method according to any one of claims 1-16.

18. A computer-readable storage medium, wherein: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a communication device, the communication device is enabled to execute the communication method according to any one of claims 1 to 16.

Images